CyberheistNews Vol 6 #15 [FBI ALERT] Dramatic Increase In Email CEO Fraud To 2.3 Billion.

A brand new Alert by the FBI on April 4th warned of a major increase in BEC (CEO Fraud), amounting to a whopping 2.3 billion dollars in losses. This is very relevant information if you are discussing IT security budget.

FBI officials are warning potential victims of a dramatic rise in the business email compromise scam or “BEC,” a scheme that targets businesses and has resulted in massive financial losses. KnowBe4 has been warning against this kind of threat for a while now, and our platform is able to simulate CEO fraud phishing attacks to inoculate your employees against this type of attack.

Here is what the FBI said:

"The schemers go to great lengths to spoof company email or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy.

"There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments.

• Law enforcement globally has received complaints from victims in every U.S. state and in at least 79 countries
• From October 2013 through February 2016, law enforcement received reports from 17,642 victims
• This amounted to more than 2.3 billion dollars in losses
• Since January 2015, the FBI has seen a 270 percent increase in identified victims and exposed loss
• In Arizona the average loss per scam is between 25,000 dollars and 75,000 dollars"

If your company has been victimized by a BEC scam:

• Contact your financial institution immediately
• Request that they contact the financial institution where the fraudulent transfer was sent
• File a complaint—regardless of dollar loss—with the IC3
  Link:
  https://www.ic3.gov/complaint/default.aspx

FBI Tips for Businesses:

• Be wary of email-only wire transfer requests and requests involving urgency
• Pick up the phone and verify legitimate business partners
• Be cautious of mimicked email addresses
• Practice multi-level authentication"

Two Important KnowBe4 Tips:

• Send high-risk users a spoofed CEO email as an effective security awareness training exercise
• Check your email server configuration right away. Do a Domain Spoof Test (no cost) and find out if your email server is configured to block spoofing, most are not! Here is the link:
  https://info.knowbe4.com/domain-spoof-test

Great story by Erika Kinetz at the Associated Press. How Mattel was the victim of CEO Fraud using phishing and social engineering to trick one of their executives in China to make a 3 Million dollars wire transfer.

She started the story with: "The email seemed unremarkable: a routine request by Mattel Inc.'s chief executive for a new vendor payment to China.

"It was well-timed, arriving on Thursday, April 30, during a tumultuous period for the Los-Angeles based maker of Barbie dolls. Barbie was bombing, particularly overseas, and the CEO, Christopher Sinclair, had officially taken over only that month. Mattel had fired his predecessor.

"The finance executive who got the note was naturally eager to please her new boss. She double-checked protocol. Fund transfers required approval from two high-ranking managers. She qualified and so did the CEO, according to a person familiar with the investigation who spoke on condition of anonymity because he was not authorized to speak about the matter. He declined to reveal the finance executive's name.

Satisfied, the executive wired over 3 million dollars to the Bank of Wenzhou, in China."

Read more about how it ended, with links to the AP story here:
https://blog.knowbe4.com/how-mattel-lost-3m-in-ceo-fraud-phishing

It's happening in the UK today, and you can see it America tomorrow. The bad guys in Eastern Europe are often using the U.K. as their beta test area, and when a scam has been debugged, they go wide in the U.S.

So here is what's happening: victims get a phishing email that claims they owe a lot of money, and it has their correct street address in the email.

The phishing emails tell recipients that they owe money to British businesses and charities when they do not.The story appeared first on the BBC website, and spread from there. More detail at the KnowBe4 Blog, and if you want to have a good chuckle, read the full story at the BBC, scroll down to the end and watch the video that they produced to explain what ransomware is:
https://blog.knowbe4.com/the-ransomware-that-knows-where-you-live

And some good news, Petya ransomware's hard disk boot record encryption has been defeated and a password generator has been released. More at:
https://blog.knowbe4.com/more-about-petya-hard-disk-lock-bsod-ransomware

Employees are the weakest link in your network security and you need effective security awareness training to keep on top of furiously innovating cybercrime.

The new features we are announcing were previously out of reach for IT managers with limited budget, and we have worked hard to make effective training and frequent simulated phishing affordable for these organizations.

The new Spring 2016 advanced features include:

EZXploit™: Patent-pending functionality that allows an internal, fully automated "human pentest". By launching a simulated phishing attack, which when clicked comes up with a secondary ruse like a Java popup that the user is further social engineered to click on. No malicious action is performed but the process allows IT to see which data is accessible and users most prone to click by scanning info such as user name, IP address, a user's workstation and Active Directory info.

KnowBe4’s Chief Hacking Officer Kevin Mitnick stated "EZXploit truly assesses whether your business can be exploited by the bad guys. Just clicking on a link sent in email alone doesn't mean your business can be successfully phished. The true test is to determine whether the user can be exploited. EZXploit allows you to evaluate that risk."

USB Drive Test™: A customer can download a special, "beaconized" Microsoft Office file from the KnowBe4 admin console onto a USB drive which can then be dropped at an on-site, high traffic area. If an employee picks up the USB drive, plugs it in their workstation, and opens the file, it will "call home" and report the fail. Should a user also enable the macros in the file, then additional data is also tracked and made available in the admin console.

A recent study sponsored by University of Illinois, University of Michigan and Google, found 98% picked up dropped USBs and 45% opened or enabled files, confirming this as an effective attack vector for social engineering.

GEO-location was added by KnowBe4 to its phishing templates, allowing an admin to see where simulated phishing attack failures are on a map, with drilldown capability and CSV-export options. This is highly useful for multi-site offices and road warriors alike.

The strong demand for KnowBe4’s training has propelled it into the Top Cybersecurity 500 and fueled unparalleled growth for 11 straight quarters. More about this here:
http://cybersecurityventures.com/cybersecurity-500/#home/?view_1_page=3

Request a demo and see for yourself how easy it is to train and phish your users:
https://info.knowbe4.com/kmsat-request-a-demo

Today, your employees are frequently exposed to sophisticated phishing and ransomware attacks. Old-school security awareness training doesn’t hack it anymore. More than ever, your users are the weak link in your network security.

Join us on Tomorrow, April 13 at 2:00 p.m. (EDT) for a 30-minute live product demonstration of the innovative Kevin Mitnick Security Awareness Training Platform and see how easy it is to train and phish your users:

• Send Phishing Security Tests to your users and get your Phish-prone percentage.
• Roll out Training Campaigns for all users (or groups) with follow-up emails to “nudge” users who are incomplete on the training.
• Point-of-failure training auto-enrollment.
• NEW Phish Alert Button for Outlook so employees can report phishing attacks.
• NEW Advanced Reporting to watch your Phish-prone percentage drop, with great ROI.

Find out how thousands of organizations have mobilized their end-users as their first line of defense. Register Now:
https://attendee.gotowebinar.com/register/6306710009986246916

"People who say it cannot be done should not interrupt those who are doing it."
- George Bernard Shaw - Writer (1856 – 1950)

"It always seems impossible until it’s done."- Nelson Mandela

Thanks for reading CyberheistNews

Well, this might be where the problem starts... CNBC wrote:

"More than 90 percent of corporate executives said they cannot read a cybersecurity report and are not prepared to handle a major attack, according to a new survey.

More distressing is that 40 percent of executives said they don't feel responsible for the repercussions of hackings, said Dave Damato, chief security officer at Tanium, which commissioned the survey with the NASDAQ.

"I think the most shocking statistic was really the fact that the individuals at the top of an organization — executives like CEOs and CIOs, and even board members — didn't feel personally responsible for cybersecurity or protecting the customer data," Damato told CNBC's "Squawk Box" on Friday.

"As a result they're handing this off to their techies, and they're really just placing their heads in the sand right now," he said.

The findings come at a time when companies around the world lost 445 billion dollars due to cybercrime last year, according to an estimate by the Center for Strategic and International Studies. More:
http://www.cnbc.com/2016/04/01/many-executives-say-theyre-not-responsible-for-cybersecurity-survey.html

The attacks are being reported in a number of organizations both large and small, who exist in a number of markets that span several verticals. Phishing is usually the root cause of infection, but there have been cases dealing with drive-by-downloads and other vectors. While Locky and TeslaCrypt are the Ransomware families that represent a majority of their work, the company also sees cases with CryptoWall and older ransomware families.

Research from Trend Micro shows that there were more Ransomware infections in February 2016, than there were in the first six months of 2015. Yet, only a fraction of ransomware attacks are actually reported.

The business model behind ransomware operations has enabled a long-lasting, turn-key operation that doesn’t require any real skill in order to ensure success – a fact that will see ransomware remain as a major concern for businesses of all types in the months to come. More at CSO:
http://www.csoonline.com/article/3052374/security/incident-response-teams-dealing-with-3-to-4-ransomware-incidents-weekly.html

"We are excited to announce the April issue of OUCH! This month, we are led by Guest Editor Samantha Davison, head of security awareness at Uber. Samantha discusses the topic "I'm Hacked, Now What." More specifically, she describes clues you can use to tell if your system has been hacked, and, if so, what you can do about it. This is a tough topic to cover, as it can quickly get technical and complex. However, Samantha kept this both simple and effective. As always, we ask you to share OUCH! with your family, friends, and coworkers."

English Version (PDF)
https://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201604_en.pdf

Ransomware is now one of the greatest threats on the internet.

In the past, IT Security firms used to monitor spear phishing attacks by espionage outfits, but these techniques are now being adopted in the criminal field and greatly contribute to their effectiveness: mass spear phishing, meet ransomware!

In a spear phishing attack, threat actors use a deep knowledge of the potential victims to target them, and that approach allows them to tailor the attack.

According to security experts at Proofpoint, a threat actor called the TA530 group has been targeting executives and other high-level employees in an attempt to compromise their machine with various malware, including the CryptoWall ransomware. More details about this at the KnowBe4 Blog:
https://blog.knowbe4.com/hello-mass-spear-phishing-meet-ransomware

Dell’s SecureWorks arm published its annual Underground Hacker Markets report, showing the latest prices offered by hackers for their goods and services.

Dell says this information was gathered by two intelligence researchers from their company’s CISO INTEL Team. They tracked criminal hackers on a number of underground forums and marketplaces scattered across the globe.

The report focuses on markets in the Russian underground as well as English-based markets, and covers Q3 2015 through Q1 2016.

The report reveals that hackers currently charge 129 dollars to hack into popular U.S.-based email accounts such as Gmail, Hotmail, and Yahoo. They’ll also go after corporate email accounts, charging 500 dollars per mailbox. Popular Russian email accounts will cost between 65 dollars and 103 dollars while breaking into popular Ukrainian email accounts will cost 129 dollars. Hacking the IP address of a computer user will cost you an extra 90 dollars. Here is the PDF with much more:
https://www.secureworks.com/assets/pdf-store/white-papers/White-Paper-The-Underground-Hacker-Marketplace.pdf

• Hong Kong man spends 50K and builds a Scarlett Johannson robot. Disturbing. :-D
  http://nextshark.com/ricky-ma-humanoid-robot-scarlett-johansson/

• SCHAFT Unveils Awesome New Bipedal Robot at Japan Conference. This thing is pretty weird and amazing at the same time:
  http://spectrum.ieee.org/automaton/robotics/humanoids/shaft-demos-new-bipedal-robot-in-japan

• Brain Break: 5 Robot Fails That Show Machines Won't Take Over (Just Yet):
  https://www.entrepreneur.com/article/273773

• Some crazy guys in Finland connected a running chainsaw to a big drone. Several snowmen were hurt. It must get boring there in winter:
  http://www.geek.com/news/crazy-finns-stuck-a-chainsaw-on-a-drone-1651368/

• Hovering in a wind tunnel, Maja Kuczynska is the Junior World Champion in Freestyle Indoor Skydiving:
  http://www.flixxy.com/this-woman-can-fly-indoor-skydiving-world-champion.htm?utm_source=4

• A Tesla Model S P90D races against a Qantas Airlines Boeing 737-800 at Melbourne airport in Australia:
  http://www.flixxy.com/tesla-model-s-vs-boeing-737.htm

• Driver and Motorcyclist Get Into Incredibly Dangerous Road Rage Battle:
  https://youtu.be/tHbh2l9eoHE

• Hannes Arch weaves his aerobatic plane at high speed through the turbines of a wind farm high up in the Austrian Alps.
  http://www.flixxy.com/slalom-flying-through-a-wind-farm-in-austria.htm?utm_source=4

• Watermelon explodes after adding one rubber band at a time:
  https://www.facebook.com/BuzzFeedVideo/posts/1955258227948383